tree ff7f9358ec7ef2689aafb2b199a9052edb9b1efb
parent 5180158345f8d7ddbfea9286807018175d6da9b4
author lifeng <lifeng@codeaurora.org> 1553076326 +0800
committer Yeshwanth Sriram Guntuka <ysriramg@codeaurora.org> 1557394482 +0530

wlan: Fix possible buffer overflow in sirConvertAddtsRsp2Struct

In the function sirConvertAddtsRsp2Struct, iterator j is
assigned with the value pAddTs->numTclas + addts.num_WMMTCLAS.
The j value is used as the index to the array pAddTs->tclasInfo.
Maximum limit on  pAddTs->tclasInfo entries is 2. So when the
value of j exceeds 2, then a possible buffer overflow could
occur.

Validate the value of j against SIR_MAC_TCLASIE_MAXNUM(2).

Change-Id: Icc723380ed4ccd51c729194d509e288be0e0712c
CRs-Fixed: 2449899